Executive brief
XXL-JOB is a popular distributed task scheduling framework used by businesses to manage and automate background jobs. A security vulnerability in the job trigger component allows an authenticated user to force the server to make unauthorized network requests. This could be used by an attacker to scan internal network resources that are not normally accessible from the outside, potentially leading to further information gathering or attacks on internal infrastructure.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in XXL-JOB v3.4.0 within the 'xxl-job-admin/jobinfo/trigger' component. The vulnerability is located in the handling of the 'addressList' parameter during a job trigger request. An authenticated attacker can supply a malicious URL (such as an internal IP or a DNS logging service) to this parameter. The server then attempts to connect to the provided address, allowing the attacker to perform internal port scanning or interact with internal services that the XXL-JOB server has access to. This requires valid credentials for the XXL-JOB admin interface.
Affected products
- xuxueli XXL-JOB 3.4.0
Timeline
- 2026-07-31: disclosed: Initial NVD publication date